From 3ba8254aecd7730f5b34211478e73b96b514c7b2 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Fri, 14 Aug 2026 12:23:36 +0000 Subject: [PATCH] feat: Hide secrets on api and channels --- docs/vantage/notification-channels.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/vantage/notification-channels.md b/docs/vantage/notification-channels.md index 91535e2..e1e0373 100644 --- a/docs/vantage/notification-channels.md +++ b/docs/vantage/notification-channels.md @@ -64,6 +64,15 @@ Posts the alert as message content. Port `465` uses implicit TLS; anything else uses STARTTLS. +### Credentials are never read back + +The SMTP `password`, the Telegram `token` and the webhook, Slack and Discord +`url`s come back from `GET /api/channels` as `••••••••` — a webhook URL is the +authorisation to post to that channel, so it is treated as a credential like +the rest. Writing that value back unchanged keeps the stored one, which is what +lets you rename a channel without retyping its password. Anything else you send +is written as given, so clearing the field clears the credential. + Alert emails look like the rest of the mail Vantage sends you. ## The message